Repair native movement identity and bounded operation flows

Author: KSemenenko

README.md

@@ -96,7 +96,7 @@ flowchart LR
 
 The earlier resource-lifetime and analytics-root repair checkpoint passed its strict solution build, all **45 selected native whole-operation tests**, all **three selected process/native recovery tests**, and the actual SDK/MCP RF3 authorization scenario through all-three-node same-root cold restart. These are local development proofs. Earlier scenarios and failures retain their original source scope; whole-product and Linux qualification remain open.
 
-Свіжа повна strict Release збірка **R619: 0 warnings / 0 errors**. Канонічний formatter пройшов scoped-перевірку20 нових/змінених файлів; це не повна перевірка форматування репозиторію. Зібрано виправлення початкового inventory origin, native8KiB capture/Blob limits, body-owned SQL envelopes, actual hosted signed outer reply під8192-byte cap і паралельних warm/cold хвиль восьми cold-користувачів. Їхні focused Unit/recovery та public inventory/movement/cold reruns ще не кваліфіковані. На попередньому `244900c1` R608 мав7/7 цільових shared-domain recovery PASS, R607 —1/3 Unit PASS і2 FAIL; історичні R597 Unit35/38, R598 recovery13/20 та R599 analyzers391/391 зберігають власні source cohorts. Прийнята normal ONE/RF3 пара не закриває окремі failures, DROP/AnalyticsStore або повну кваліфікацію.
+Остання успішна повна strict Release збірка — **R619: 0 warnings / 0 errors**, до поточного пакета виправлень. На checkpoint `46764194` **R612 Unit 38/42 PASS, 4 FAIL; R613 related recovery 20/20 PASS**, source/DLL drift0. Публічний RF3 inventory відмовив під час другої fault-перевірки через закриту probe-fixture; перший public MOVE повернув `BudgetExceeded`, точний gate ще не встановлено. Поточний пакет виправляє Close witness, native journal DTO accounting, joined cold shutdown, native movement identity та scoped probe cleanup; додає bounded original SDK error witness і справжній native fingerprint whole flow. Повна R634 збірка скомпілювала product та Unit/Recovery проєкти, але завершилася з однією CS0103 в integration-діагностиці; R635 додав фактичний import наявного контракту. Наступна R636 спроба завершилася exit1 без project output, з 0 logged warnings/errors; це не успішна збірка. Native MSBuild sidecars у той самий проміжок повідомляють про заборонене створення worker IPC; вони не містять parent PID. Спільна збірка з дозволеним native IPC і повторні цільові перевірки очікуються. Scoped whitespace27 пройшов; повна canonical format/Linux кваліфікація відкрита. Raw coverage лише цієї 42-case Unit-вибірки — 21,82% production lines, з 4 failed cases і без load; це не повне або прийняте покриття проєкту. Прийнята normal ONE/RF3 пара не закриває DROP/AnalyticsStore, нові cold-сценарії або повну кваліфікацію.
 
 The separate [all-model cold-reopen pair](docs/Features/DatabaseComposition/FunctionalDatabaseColdReopen.md) also passed on `57cea624`: **one node in 104.61 seconds, then RF3 in 118.73 seconds**. After all original nodes restarted through Aspire, both clients replayed the original SQL, mixed-model and blob-stage commands with complete receipt/value checks, then verified persisted grant revocation, repair and a healthy write. These tests keep the same physical roots and credentials. They use three cold-only identities and do not claim the normal gate's eight-user concurrency.
 

docs/ADR/ADR-060-native-internal-serialization.md

@@ -538,3 +538,52 @@ REQ-IS-TYPE-FRAMING-002: directly qualify the new synchronous NativeEncodedTypeM
 AC-IS-TYPE-FRAMING-002: representative CommandRequest and QueueCounters operations retain exact native frame bytes/type, then all literal command ownership/partition/derived mutation fields and counter fields survive actual serialization. A corrupt native type-version frame is denied by the actual reader before a healthy fresh reader/frame/complete typed operation succeeds. Twenty concurrently admitted fresh-session operations use bounded Parallel.ForEachAsync and an owned admission barrier, await/join all tasks, and compare each independent frame/full payload to the original literal fixture. An already-cancelled owner denies parallel admission, then a fresh healthy operation succeeds. The synchronous production Measure method has no cancellation parameter; cancellation qualifies only the test's owning concurrent-work admission/join, never preemption of Measure. Writer disposal is in finally and real session disposal in using on success/error; no borrowed provider disposal.
 
 Implementation: UnitTests InternalSerialization Cases/NativeEncodedTypeMeasureTests.cs owns three complete scenarios; Fixtures/NativeEncodedTypeFrameFixture.cs owns real native writer/reader APIs and literal payloads. Related ADR060, REQ/AC-IS-TYPE-FRAMING-001 and TASK-KL036-NATIVE-TYPE-FRAMING-001 remain unchanged. Root owns guarded source join/full build/normal+scalar native metadata and runtime qualification. These tests qualify framing/serializer operations only; current63-schema parent capacity, operational+1, arbitrary future SafeDetail, and genuine parent/RF3 gates remain OPEN. Rollback removes only these additive tests/docs; no persistence/alias/ID/format/API/default changes. Source-authored cases are not observed discovery or PASS.
+
+## Movement native identity representation repair (R612, source-only)
+
+The homogeneous current movement path retains its complete generated
+`PartitionMovementAuthenticatedCommandV1` root (original phase, complete body,
+receiver admission and lifetime proofs) in the existing authenticated native
+payload. Its synthetic `ReplicatedOperation.PayloadJson` is empty. All native
+phase, authenticated payload, transport, command, scan, deadline and total
+retention limits remain unchanged; an actual native oversize is still refused
+before effects. This is not permission to enlarge an operation or omit any family.
+
+The full duplicated JSON phase can exceed MaxBatchBytes solely through base64
+and repeated routing fields even when the complete native operation fits. It is
+therefore generated transiently by the existing Microsoft JSON serializer into
+the existing incremental hash, not retained beside the owning native root. The
+outer opaque JSON-string fingerprint bytes are EXACTLY the former canonical
+CommandFingerprint: same field order, enum spelling, string escaping and all
+original phase/body content, with only the existing receiver-admission exclusion,
+ControlAdmit evaluation/expiry normalization and RetireCancel transport exclusions.
+No digest replaces the full operation, and no handwritten parser or encoder is
+introduced. Transient serializer storage is bounded by the already admitted native
+input; the streaming adapter does not accumulate expanded identity output.
+
+This is a forward-only homogeneous current-format contract: exact native root and
+empty synthetic identity are mandatory on issue, local apply, retained outcome
+lookup and borrowed replica authority validation. Nonempty duplicate identity,
+wrong native roots and missing/duplicate lifetime-proof roots are rejected as
+Corruption before effects. Generated serializer aliases/field IDs and all original
+fingerprint digests remain unchanged. There is no automatic stored-record rewrite,
+old/new representation fallback, compatibility reader or mixed-version deployment.
+An incompatible persisted/replica cohort remains refused under the existing format
+and deployment gates.
+
+Focused validation must retain both original actual-8192 whole-flow regressions,
+all six Blob outcomes, full receipts, native full-carrier oversize refusal,
+healthy completion and two cold cuts. Actual issued operations are compared with
+an independent complete former-JSON fingerprint oracle, including borrowed authority
+input; native size and former expanded identity size are retained as bounded numeric
+evidence. Re-signed wrong-root/missing/duplicate-proof variants and nonempty duplicate
+identity must refuse with unchanged original owners. Source, strict build and runtime
+results are separate gates; this source repair is not current Linux/RF3 acceptance.
+
+The explicit serializer execution wrapper is validated before movement decoding.
+Its admitted FingerprintChunkCharacters flows unchanged through movement
+canonicalization and the opaque-string hash stream, including the borrowed native
+fingerprint overload; default callers retain the existing process wrapper. Real
+issued-phase controls compare the former complete JSON fingerprint under both the
+process policy and a different admitted two/three-byte policy, on owned and borrowed
+paths, without changing the operation or interpreting a getter as execution proof.

docs/Features/ResourceExecution/ResourceOwnerInventory.md

@@ -181,3 +181,10 @@ The owning Core repair is the exact origin transformation verifier in `ClusterRe
 The terminal target Abort cleanup removes only its validated partition/move import checkpoint in the same atomic transaction as the final cleanup state. A missing checkpoint is allowed when import never began. Malformed or mismatched checkpoints fail the operation; unrelated import checkpoints, original origin provenance and conservative holder history are preserved. Abort must never promote an unknown origin.
 
 The owning native flow is `D2ImportAbortRecoveryTests.TargetAbortRemovesOnlyItsCompletedImportFenceAndPreservesUnrelatedWritesAndOriginAcrossTwoColdOwners(false/true)`: two genuine partially copied imports, full target/source Abort for one, unrelated writes, remaining-import refusal, completion of the other, exact original receipt replay and two cold openings. The unknown variant performs a real principal commit before first catalog bootstrap; it does not edit origin or import records directly. Source integration and compilation do not count as execution, RF3 or power-loss proof.
+
+
+### RF3 inventory held-operation cleanup
+
+The existing public RF3 scenario runs original cancellation and persisted policy invalidation holds sequentially in one live private probe session. Each held-operation owner releases only its own validated arm/request, joins its original producer, verifies actual settlement and retires that arm. A successful earlier release is retained locally so cleanup cannot release it twice. Per-operation cleanup must not call the fixture-wide ReleaseOpenArmsAsync, which intentionally stops admission for final teardown. The original wave owner still closes admission, joins every Aspire resource and retains the final strict unsettled-arm checks during cleanup.
+
+The same original inventory case must complete both holds, exact no-effect/current-policy checks, genuine owner unavailability/recovery and two cold reopens. Source correction alone does not qualify those operations; the original R614 stopped-admission failure and its complete logs remain unchanged. Product inventory, authorization, deadlines, resource bounds and private probe security are unchanged.